Product and Software: This article applies to all Aruba controllers and ArubaOS versions.
In the WebUI, the Monitoring > Global Events page displays various IDS events.
The message "Event IDS: EAP handshake rate anomaly" means that a client was trying to flood the authentication server with wrong credentials. IDS reports this event with the MAC address of "aruba Ap", which means that it was detected through that AP.
The Aruba switch detects this event as a rate anomaly.